<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=18" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <link rel="canonical" href="https://twitter.com/CraigHRowland/status/1593102427276050433" />
    <title>Craig Rowland - Agentless Linux Security (@CraigHRowland): &quot;More ways to decloak hidden data from Linux LKM stealth rootkits using command line tools:

grep . &#x2F;etc&#x2F;modules
dd count=1000 bs=1 if=&#x2F;etc&#x2F;modules 2&gt;&#x2F;dev&#x2F;null

Quiz: Why does the above decloak the hidden data in this style of Linux rootkit?&quot;|nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#1F1F1F" />
    <meta property="og:type" content="photo" />
    <meta property="og:title" content="Craig Rowland - Agentless Linux Security (@CraigHRowland)" />
    <meta property="og:description" content="More ways to decloak hidden data from Linux LKM stealth rootkits using command line tools:

grep . /etc/modules
dd count=1000 bs=1 if=/etc/modules 2&gt;/dev/null

Quiz: Why does the above decloak the hidden data in this style of Linux rootkit?" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="image/png" href="/pic/media%2FFhvU8STaMAESGUz.jpg%3Fname%3Dsmall" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FFhvU8STaMAESGUz.jpg" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FFhvU8STaMAESGUz.jpg" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="image/png" href="/pic/media%2FFhvU-CjaYAARjcY.jpg%3Fname%3Dsmall" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FFhvU-CjaYAARjcY.jpg" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FFhvU-CjaYAARjcY.jpg" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" alt="Logo" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/CraigHRowland/status/1593102427276050433"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <div class="icon-container"><a class="icon-cog" title="Preferences" href="/settings?referer=%2FCraigHRowland%2Fstatus%2F1593102427276050433%23m"></a></div>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread">
          <div id="m" class="main-tweet"><div class="timeline-item thread thread-line"><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1593102427276050433#m" title="Nov 17, 2022 · 4:43 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">More ways to decloak hidden data from Linux LKM stealth rootkits using command line tools:

grep . /etc/modules
dd count=1000 bs=1 if=/etc/modules 2&gt;/dev/null

Quiz: Why does the above decloak the hidden data in this style of Linux rootkit?</div>
                <div class="attachments"><div class="gallery-row" style="">
                    <div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFhvU8STaMAESGUz.jpg" target="_blank"><img src="/pic/media%2FFhvU8STaMAESGUz.jpg%3Fname%3Dsmall" alt="" /></a></div>
                    <div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFhvU-CjaYAARjcY.jpg" target="_blank"><img src="/pic/media%2FFhvU-CjaYAARjcY.jpg%3Fname%3Dsmall" alt="" /></a></div>
                  </div></div>
                <p class="tweet-published">Nov 17, 2022 · 4:43 AM UTC · Twitter Web App</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 8</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 26</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 104</div></span>
                </div>
              </div></div></div>
          <div class="after-tweet thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/CraigHRowland/status/1593105928890765312#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1593105928890765312#m" title="Nov 17, 2022 · 4:57 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">This is what the data looks like if you used the cat, more, less or similar commands. Even editors like vi won't show it there. You need to get creative to investigate an active LKM rootkit on Linux.</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/orig/media%2FFhvZJMNaAAAr0ZR.png" target="_blank"><img src="/pic/media%2FFhvZJMNaAAAr0ZR.png%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 10</div></span>
                </div>
              </div>
            </div></div>
        </div>
        <div id="r" class="replies">
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/jw4lsec/status/1593106187905826816#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/jw4lsec"><img class="avatar round" src="/pic/profile_images%2F1567252689599483905%2FTeg-xFsL_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/jw4lsec" title="Jace">Jace</a>
                        <a class="username" href="/jw4lsec" title="@jw4lsec">@jw4lsec</a>
                      </div>
                      <span class="tweet-date"><a href="/jw4lsec/status/1593106187905826816#m" title="Nov 17, 2022 · 4:58 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">What do initial attempts to view the hidden data look like? cat, for example</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/jw4lsec/status/1593106297108717568#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/jw4lsec"><img class="avatar round" src="/pic/profile_images%2F1567252689599483905%2FTeg-xFsL_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/jw4lsec" title="Jace">Jace</a>
                        <a class="username" href="/jw4lsec" title="@jw4lsec">@jw4lsec</a>
                      </div>
                      <span class="tweet-date"><a href="/jw4lsec/status/1593106297108717568#m" title="Nov 17, 2022 · 4:58 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Oh you just replied with that 😂</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 1</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/jw4lsec/status/1593106938715598849#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/jw4lsec"><img class="avatar round" src="/pic/profile_images%2F1567252689599483905%2FTeg-xFsL_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/jw4lsec" title="Jace">Jace</a>
                        <a class="username" href="/jw4lsec" title="@jw4lsec">@jw4lsec</a>
                      </div>
                      <span class="tweet-date"><a href="/jw4lsec/status/1593106938715598849#m" title="Nov 17, 2022 · 5:01 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">Is it because the LMK rootkit is scrubbing output based on a hardcoded set of strings? Where cat/more/less would be returning the entirety of the matched string vs grep returning character by character because of the '.' interpretation, and dd because bs=1 aka one byte at a time?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/akaclandestine/status/1593186827380592640#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/akaclandestine"><img class="avatar round" src="/pic/profile_images%2F1591547587542253571%2FVs0PRcSz_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/akaclandestine" title="Clandestine">Clandestine</a>
                        <a class="username" href="/akaclandestine" title="@akaclandestine">@akaclandestine</a>
                      </div>
                      <span class="tweet-date"><a href="/akaclandestine/status/1593186827380592640#m" title="Nov 17, 2022 · 10:18 AM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">this file does not exist for like redhat , how can i check in that environment ?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/CraigHRowland/status/1593301435571404801#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1593301435571404801#m" title="Nov 17, 2022 · 5:53 PM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">There are many places a malicious module can hide from where it started. Look also under /etc/init.d and /etc/rc*.d directories also.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/timb_machine/status/1593345966886854658#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/timb_machine"><img class="avatar round" src="/pic/profile_images%2F68168727%2F2007061702-debconf_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/timb_machine" title="Tim Brown">Tim Brown</a>
                        <a class="username" href="/timb_machine" title="@timb_machine">@timb_machine</a>
                      </div>
                      <span class="tweet-date"><a href="/timb_machine/status/1593345966886854658#m" title="Nov 17, 2022 · 8:50 PM UTC">Nov 17</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">That's a neat trick.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/weedcoder/status/1593914781236596736#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/weedcoder"><img class="avatar round" src="/pic/profile_images%2F1379807224453865473%2FENth3uks_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/weedcoder" title="4BAD3A6E2B53D83DF0860F373B8FB12C934CB86F">4BAD3A6E2B53D83DF0860F373B8FB12C934CB86F</a>
                        <a class="username" href="/weedcoder" title="@weedcoder">@weedcoder</a>
                      </div>
                      <span class="tweet-date"><a href="/weedcoder/status/1593914781236596736#m" title="Nov 19, 2022 · 10:31 AM UTC">Nov 19</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">EOF ?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/gat3way/status/1593949993924182017#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/gat3way"><img class="avatar round" src="/pic/profile_images%2F445602589%2Fnsa-hq-fort-meade-md1_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/gat3way" title="gat3way">gat3way</a>
                        <a class="username" href="/gat3way" title="@gat3way">@gat3way</a>
                      </div>
                      <span class="tweet-date"><a href="/gat3way/status/1593949993924182017#m" title="Nov 19, 2022 · 12:51 PM UTC">23h</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/CraigHRowland">@CraigHRowland</a></div>
                <div class="tweet-content media-body" dir="auto">because the lkm hooks read syscall and replaces strings in buffer with zero bytes and gets defeated by reading single byte?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1593951344351940608#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar round" src="/pic/profile_images%2F1533597714381803520%2F9-0dOYFp_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Craig Rowland - Agentless Linux Security">Craig Rowland - Agentless Linux Security</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1593951344351940608#m" title="Nov 19, 2022 · 12:56 PM UTC">23h</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Correct!</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item more-replies"><a class="more-replies-text" href="/CraigHRowland/status/1593951344351940608#m">more replies</a></div>
          </div>
          <div class="show-more"><a href="?cursor=LBl2gIDUueTo7JssgMDQrc%2B%2BkZwsgMDQnY7D3J4sgoCymeHE7J4sgsDTtb6U7ZssgMDS0drZ7JsshIC9ieHt2ZwsJQQRAAA%3D#r">Load more</a></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>